Computer Aided Design Solutions for Testability and Security Qihang Shi University of Connecticut - Storrs, [email protected]
Total Page:16
File Type:pdf, Size:1020Kb
University of Connecticut OpenCommons@UConn Doctoral Dissertations University of Connecticut Graduate School 8-18-2017 Computer Aided Design Solutions for Testability and Security Qihang Shi University of Connecticut - Storrs, [email protected] Follow this and additional works at: https://opencommons.uconn.edu/dissertations Recommended Citation Shi, Qihang, "Computer Aided Design Solutions for Testability and Security" (2017). Doctoral Dissertations. 1640. https://opencommons.uconn.edu/dissertations/1640 Computer Aided Design Solutions for Testability and Security Qihang Shi, Ph.D. University of Connecticut, 2017 As technology down scaling continues, new technical challenges emerge for the Inte- grated Circuits (IC) industry. One direct impact of down-scaling in feature sizes leads to elevated process variations, which has been complicating timing closure and requiring classification of fabricated ICs according to their maximum performance. To address this challenge, speed-binning based on on-chip delay sensor measurements has been proposed as alternative to current speed-binning methods. This practice requires ad- vanced data analysis techniques for the binning result to be accurate. Down-scaling has also increased transistor count, which puts an increased burden on IC testing. In particular, increase in area and capacity of embedded memories has led to overhead in test time and loss test coverage, which is especially true for System-on-Chip (SOC) Qihang Shi, University of Connecticut, 2017 designs. Indeed, expected increase in logic area between logic and memory cores will likely further undermine the current solution to the problem, the hierarchical test ar- chitecture. Further, widening use of information technology led to widened security concerns. In today’s threat environment, both hardware Intellectual Properties (IP) and software security sensitive information can become target of attacks, malicious tamper- ing, and unauthorized access. Therefore, it is necessary for existing design flows to be properly improved to address these new challenges. Among possible options, mathematical optimization and novel architectural designs have time and again proved to be most promising approaches. In this work, we focus on developing new tools for this purpose by augmenting existing design flow. Imple- mentation results on benchmarks proves proposed solutions to be effective and efficient. Computer Aided Design Solutions for Testability and Security Qihang Shi B.E., Tsinghua University, Beijing, 2001 M.S., Lund University, Lund, 2009 A Dissertation Submitted in Partial Fullfilment of the Requirements for the Degree of Doctor of Philosophy at the University of Connecticut 2017 i Copyright by Qihang Shi 2017 ii APPROVAL PAGE Doctor of Philosophy Dissertation Computer Aided Design Solutions for Testability and Security Presented by Qihang Shi, M.S. Major Advisor Mark M. Tehranipoor Associate Advisor Domenic Forte Associate Advisor Lei Wang Associate Advisor Rajeev Bansal Associate Advisor John Chandy University of Connecticut 2017 iii To My Loving Family iv ACKNOWLEDGEMENTS I am deeply grateful to my advisor, Dr. Mark M. Tehranipoor, for his support and guid- ance during my Ph.D. study at the University of Connecticut. Pursuing Ph.D. under his advisory was an opportunity that I treasured greatly and I hope in the end I’ve delivered enough to match the confidence invested in me. At times, it seemed question- able whether I would ever think fast enough to keep up with his analytical and critical prowess; yet as I push myself over the edge, I eventually saw myself performing at a rate I did not consider possible for me. Dr. Tehranipoor will forever remain a shining example of excellence as a researcher, mentor, and entrepreneur in my heart. I would like to also express my gratitude to Dr. Domenic Forte for his inspiring and patient guidance over the past two years. Many of my small achievements would not have been possible without his insightful comments and advices. I shall admire and try my best to emulate his academic vision and diligent work ethnic in my future ca- reers. I’d like to offer my sincere thanks to Dr. John Chandy, Dr. Rajeev Bansal, and Dr. Lei Wang for joining my Advisory Committees and providing constructive feed- back. Dr. Chandy and Dr. Bansal both kindly offered help when I most needed it, to which I shall remain forever grateful. I would like to further convey my thanks to all industrial coordinators who have su- pervised and advised my work, Mr. LeRoy Winemberg, Dr. Ramesh Tekumalla, and v Dr. Lisa McIlrath, who extended generous aid during my training to become a compe- tent researcher. Special thanks to all my labmates: Shuo Wang, Hassan Salmani, Xuehui Zhang, Wei Zhao, Jifeng Chen, Fang Bao, Niranjan Kayam, Kan Xiao, Ujjwal Guin, Gustavo Con- treras, Kun Yang, Md. Tauhidur Rahman, Adib Nahiyan, Miao He, Zimu Guo, Mehdi Sadi, Fahim Rahman, and Halit Dogan for their help and cooperation. The discussions and exchanges of knowledge enriched my skills and experience. I am also deeply in- debted to my teachers, mentors, classmates and friends in my life. There are so many of them that I cannot list all their names. Words cannot delineate my appreciation to my family for their love and support. My parents, Yexin Shi and Yueping Zhou, whose confidence in me and support afforded me through my darkest years into a brighter future. My work is indeed impossible with- out your support through the years. As I dedicate this humble work to you, I hope it furnishes a little consolation for all the paths we opted not to tread. vi TABLE OF CONTENTS 1. INTRODUCTION ::::::::::::::::::::::::::::: 1 1.1 Related Work ................................4 1.1.1 Speed-binning with Ring Oscillators and Modeling of Process Variations4 1.1.2 Raising Time Cost in System-on-Chip (SoC) Memory Tests . .6 1.1.3 Threat and Countermeasures of Circuit Microprobing Attacks . .8 1.1.4 Threat of Untrusted Foundries and Existing Countermeasures . 10 1.2 Motivations and Contributions ....................... 22 2. OPTIMIZED SENSOR SELECTION WITH GENETIC ALGORITHM 27 2.1 Optimization Algorithm . 29 2.2 Simulated Binning using SPICE . 32 2.2.1 Objective and Method . 32 2.2.2 Model Assumptions used in this Simulation . 33 2.2.3 Method of Implementation . 34 2.2.4 Simulation Results . 36 2.3 Experimental Result using Silicon Data . 40 2.4 Sensor Design . 40 2.5 Measurements . 42 2.6 Optimization Results and Analyses on Silicon Data . 44 2.7 Summary . 46 vii 3. CONCURRENT APPLICATION OF MEMORY AND LOGIC TESTS 48 3.1 Ensuring Concurrency . 51 3.2 Testing Memory Access Paths . 57 3.3 Contribution to Test Scheduling . 65 3.4 Experimental Results . 66 3.5 Discussion on Results . 74 3.6 Summary . 76 4. A LAYOUT-DRIVEN FRAMEWORK TO EVALUATE VULNERABILI- TIES TO MICROPROBING ATTACKS ::::::::::::::::: 77 4.1 Modeling Bypass Attack . 81 4.2 Algorithm to Find Exposed Area . 85 4.3 Evaluation Results . 89 4.3.1 Evaluation of algorithm . 89 4.3.2 Performance evaluation of active shield . 91 4.3.3 Future research directions . 92 4.4 Summary . 93 5. OBFUSCATED BUILT-IN SELF-AUTHENTICATION (OBISA) :::: 94 5.1 Combining BISA with Split Manufacturing Techniques . 98 5.2 Obfuscated Built-In Self-Authentication via Wire Lifting . 102 5.2.1 Cost of Wire Lifting . 105 viii 5.2.2 Fast Wire Lifting . 108 5.2.3 Implementation Flow . 117 5.3 Experimental Evaluation . 127 5.3.1 Performance of BP-based Wire Lifting Algorithm . 129 5.3.2 Pin-based vs. Cell-based Definition of Edges . 132 5.3.3 Security Evaluation with Known Layout-based Metrics . 132 5.3.4 Implementation and Overhead on Large Designs . 136 5.4 Summary . 142 6. Conclusion ::::::::::::::::::::::::::::::::: 143 6.1 Future Work . 144 6.2 IMPACT OF THE DISSERTATION WORK ............... 146 Bibliography 147 ix LIST OF FIGURES 1.1 Typical cross-sections of microprocessors (MPU) and Application-Specific Integrated Circuits (ASIC) [1] . .9 1.2 Typical split manufacturing arrangement (assuming split made between Metal 2 and Metal 1 layers). 11 1.3 Structure of (a) BISA, (b) four-stage LFSR, and (c) four-stage MISR. 14 1.4 Principle of k-security applied to a full adder circuit as an example. 26 2.1 Block diagram of an RO sensor. 27 2.2 Block diagram of an Path-RO sensor. 28 2.3 Flowchart of the proposed optimization algorithm. 30 2.4 Accuracy of SVM classification without optimizing sensor selection. 37 2.5 Evolution of SVM classification accuracy under GA-based optimization of sensor selection. 39 2.6 On-chip sensor block layout (left) and their locations (right) in the fabri- cated SoC die. In the figure, RO sensors are denoted as “IR sensor" and Path-RO sensors as “PUT". 40 2.7 Per-die average of normalized measured sensor delay, organized by sensor modules, compared against FMAX..................... 42 2.8 Evolution of an exemplary process of proposed optimization algorithm. 45 x 2.9 Frequency of each sensor appearing in best accuracy sensor selection list, weighted by classification accuracy. 45 3.1 Timing scheme of sequential application of logic and memory test. 48 3.2 A typical memory access structure. 49 3.3 Proposed architecture: Test Scheme 1 - Bypass to leave MLFFs and MCFFs outside of memory test path: MUX inserted at MLFF Q-pins (solid red, solid line); Test Scheme 2 - Include MLFFs and MCFFs in memory test path: MUX inserted at MLFF SI-pins (slashed red, dashed line). 52 3.4 Comparison of test time between (a) Scheme 1 (Q-pin bypass) and (b) Scheme 2 (SI-pin bypass). 54 3.5 Comparison of test time between (a) Scheme 1 (Q-pin bypass) and (b) Scheme 2 (SI-pin bypass). 56 3.6 Pattern rearranging algorithm. 58 3.7 Test generation approaches: (a) Unaltered MLFF scan chain (black) with additional circuitry to reconfigure it into decompressor for determinis- tic test approach (solid red/solid line) and circuitry to reconfigure it into linear feedback register (LFSR) for pseudo random pattern approach (slashed red/dotted line); (b) MCFF scan chain (black) reconfigured into response compactor (empty red/solid line) for both approaches.